lov-skill-distiller
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes external project materials, specifically Git logs and Markdown files. This presents an attack surface where malicious instructions embedded in a project's documentation or commit history could attempt to manipulate the agent's distillation logic.\n
- Ingestion points: Project Markdown files and Git history logs processed via
scripts/collect-source-evidence.py.\n - Boundary markers: The skill uses a structured template for output but does not utilize explicit delimiters to encapsulate or neutralize potentially malicious instructions within the ingested text.\n
- Capability inventory: The skill can read file system content, execute bundled Python scripts, and run the
gitbinary.\n - Sanitization: Content is filtered for keywords and line-length but is not sanitized against structural prompt injection.\n- [COMMAND_EXECUTION]: The included script
scripts/collect-source-evidence.pyexecutes system commands viasubprocess.runto interact with Git. While the script uses list-based arguments to avoid shell injection, it performs operations on user-specified project paths.\n- [DYNAMIC_EXECUTION]: The workflow requires the agent to execute local Python scripts (collect-source-evidence.pyandvalidate_skill.py) that are packaged with the skill to automate evidence collection and verify the output's compliance with schema requirements.
Audit Metadata